* SECURITY UPDATE: InnoDB virtual columns in cascades - debian/patches/CVE-2025-50085.patch: correct InnoDB virtual-column calculation during foreign-key cascade actions so child-table updates are used directly. This prevents virtual values from being left uncomputed or incorrectly set to NULL, which can corrupt virtual-column indexes. - CVE-2025-50085 * SECURITY UPDATE: DDL buffer memory growth (content of CVE-2025-53044) - debian/patches/CVE-2025-53044-root.patch: the Bug#37233273 backport (upstream de289afb, "DDL buffer increase has out of control memory usage") is attributed to CVE-2025-53044; shipped under its correct CVE id. - CVE-2025-53044 * SECURITY UPDATE: range query crash on index-prefixed BLOB/TEXT columns - debian/patches/CVE-2025-50077.patch: true fix for CVE-2025-50077, backport of upstream Bug#31360522 (commit c51237cec9f6, 8.0.43): create separate prefix-key Field objects for BLOB columns and destroy Field_blob objects in closefrm() to avoid out-of-bounds access during end-range key comparison. - CVE-2025-50077 * SECURITY UPDATE: sort_keys comparator self-comparison crash - debian/patches/CVE-2025-21499.patch: the sort_keys comparator can be called with the same element during std::sort, violating the C++ comparison requirements and causing mysqld initialization crashes. Add an identity guard so self-comparisons return false. - CVE-2025-21499 * SECURITY UPDATE: Performance Schema data lock scans - debian/patches/CVE-2025-21534.patch: Performance Schema data_locks and data_lock_waits performed full scans for primary-key lookups from sys.innodb_lock_waits, generating excessive InnoDB locks and degrading server workload. Add primary keys and point-select handling so each wait fetches only the matching locks. - CVE-2025-21534 * SECURITY UPDATE: relay log sanitizer transaction boundary detection - debian/patches/CVE-2025-30684.patch: fix incorrect transaction boundary detection in the relay log sanitizer (log_sanitizer.cc). Add COMMIT/ROLLBACK checks in process_query_event and correctly set m_in_transaction in process_xid_event, preventing relay log corruption when replicating prepared transactions. - CVE-2025-30684 * Note: the oct2024 bugfix-set, the 2024_bugfix11 CVE-2024-21232 named fix and the alpine sha512sum fix originally carried by this merge request are already contained in the reworked els31 base entry; 2024_bugfix06 (Bug#37061960) and CVE-2024-21238 (Enterprise-only Thread Pool) remain dropped.